Dan Carpenter reported:
> kernel/sched/rt.c:1347 pick_next_task_rt() warn: variable dereferenced before check 'prev' (see line 1338)
> kernel/sched/deadline.c:1011 pick_next_task_dl() warn: variable dereferenced before check 'prev' (see line 1005)
Kirill also spotted that migrate_tasks() will have an instant NULL
deref because pick_next_task() will immediately deref prev.
Instead of fixing all the corner cases because migrate_tasks() can
pass in a NULL prev task in the unlikely case of hot-un-plug, provide
a fake task such that we can remove all the NULL checks from the far
more common paths.
A further problem; not previously spotted; is that because we pushed
pre_schedule() and idle_balance() into pick_next_task() we now need to
avoid those getting called and pulling more tasks on our dying CPU.
We avoid pull_{dl,rt}_task() by setting fake_task.prio to MAX_PRIO+1.
We also note that since we call pick_next_task() exactly the amount of
times we have runnable tasks present, we should never land in
idle_balance().
Fixes: 38033c37fa ("sched: Push down pre_schedule() and idle_balance()")
Cc: Juri Lelli <juri.lelli@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Reported-by: Kirill Tkhai <tkhai@yandex.ru>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20140212094930.GB3545@laptop.programming.kicks-ass.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
		
	
			
		
			
				
	
	
		
			131 lines
		
	
	
	
		
			2.8 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			131 lines
		
	
	
	
		
			2.8 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
#include "sched.h"
 | 
						|
 | 
						|
/*
 | 
						|
 * stop-task scheduling class.
 | 
						|
 *
 | 
						|
 * The stop task is the highest priority task in the system, it preempts
 | 
						|
 * everything and will be preempted by nothing.
 | 
						|
 *
 | 
						|
 * See kernel/stop_machine.c
 | 
						|
 */
 | 
						|
 | 
						|
#ifdef CONFIG_SMP
 | 
						|
static int
 | 
						|
select_task_rq_stop(struct task_struct *p, int cpu, int sd_flag, int flags)
 | 
						|
{
 | 
						|
	return task_cpu(p); /* stop tasks as never migrate */
 | 
						|
}
 | 
						|
#endif /* CONFIG_SMP */
 | 
						|
 | 
						|
static void
 | 
						|
check_preempt_curr_stop(struct rq *rq, struct task_struct *p, int flags)
 | 
						|
{
 | 
						|
	/* we're never preempted */
 | 
						|
}
 | 
						|
 | 
						|
static struct task_struct *
 | 
						|
pick_next_task_stop(struct rq *rq, struct task_struct *prev)
 | 
						|
{
 | 
						|
	struct task_struct *stop = rq->stop;
 | 
						|
 | 
						|
	if (!stop || !stop->on_rq)
 | 
						|
		return NULL;
 | 
						|
 | 
						|
	put_prev_task(rq, prev);
 | 
						|
 | 
						|
	stop->se.exec_start = rq_clock_task(rq);
 | 
						|
 | 
						|
	return stop;
 | 
						|
}
 | 
						|
 | 
						|
static void
 | 
						|
enqueue_task_stop(struct rq *rq, struct task_struct *p, int flags)
 | 
						|
{
 | 
						|
	inc_nr_running(rq);
 | 
						|
}
 | 
						|
 | 
						|
static void
 | 
						|
dequeue_task_stop(struct rq *rq, struct task_struct *p, int flags)
 | 
						|
{
 | 
						|
	dec_nr_running(rq);
 | 
						|
}
 | 
						|
 | 
						|
static void yield_task_stop(struct rq *rq)
 | 
						|
{
 | 
						|
	BUG(); /* the stop task should never yield, its pointless. */
 | 
						|
}
 | 
						|
 | 
						|
static void put_prev_task_stop(struct rq *rq, struct task_struct *prev)
 | 
						|
{
 | 
						|
	struct task_struct *curr = rq->curr;
 | 
						|
	u64 delta_exec;
 | 
						|
 | 
						|
	delta_exec = rq_clock_task(rq) - curr->se.exec_start;
 | 
						|
	if (unlikely((s64)delta_exec < 0))
 | 
						|
		delta_exec = 0;
 | 
						|
 | 
						|
	schedstat_set(curr->se.statistics.exec_max,
 | 
						|
			max(curr->se.statistics.exec_max, delta_exec));
 | 
						|
 | 
						|
	curr->se.sum_exec_runtime += delta_exec;
 | 
						|
	account_group_exec_runtime(curr, delta_exec);
 | 
						|
 | 
						|
	curr->se.exec_start = rq_clock_task(rq);
 | 
						|
	cpuacct_charge(curr, delta_exec);
 | 
						|
}
 | 
						|
 | 
						|
static void task_tick_stop(struct rq *rq, struct task_struct *curr, int queued)
 | 
						|
{
 | 
						|
}
 | 
						|
 | 
						|
static void set_curr_task_stop(struct rq *rq)
 | 
						|
{
 | 
						|
	struct task_struct *stop = rq->stop;
 | 
						|
 | 
						|
	stop->se.exec_start = rq_clock_task(rq);
 | 
						|
}
 | 
						|
 | 
						|
static void switched_to_stop(struct rq *rq, struct task_struct *p)
 | 
						|
{
 | 
						|
	BUG(); /* its impossible to change to this class */
 | 
						|
}
 | 
						|
 | 
						|
static void
 | 
						|
prio_changed_stop(struct rq *rq, struct task_struct *p, int oldprio)
 | 
						|
{
 | 
						|
	BUG(); /* how!?, what priority? */
 | 
						|
}
 | 
						|
 | 
						|
static unsigned int
 | 
						|
get_rr_interval_stop(struct rq *rq, struct task_struct *task)
 | 
						|
{
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
/*
 | 
						|
 * Simple, special scheduling class for the per-CPU stop tasks:
 | 
						|
 */
 | 
						|
const struct sched_class stop_sched_class = {
 | 
						|
	.next			= &dl_sched_class,
 | 
						|
 | 
						|
	.enqueue_task		= enqueue_task_stop,
 | 
						|
	.dequeue_task		= dequeue_task_stop,
 | 
						|
	.yield_task		= yield_task_stop,
 | 
						|
 | 
						|
	.check_preempt_curr	= check_preempt_curr_stop,
 | 
						|
 | 
						|
	.pick_next_task		= pick_next_task_stop,
 | 
						|
	.put_prev_task		= put_prev_task_stop,
 | 
						|
 | 
						|
#ifdef CONFIG_SMP
 | 
						|
	.select_task_rq		= select_task_rq_stop,
 | 
						|
#endif
 | 
						|
 | 
						|
	.set_curr_task          = set_curr_task_stop,
 | 
						|
	.task_tick		= task_tick_stop,
 | 
						|
 | 
						|
	.get_rr_interval	= get_rr_interval_stop,
 | 
						|
 | 
						|
	.prio_changed		= prio_changed_stop,
 | 
						|
	.switched_to		= switched_to_stop,
 | 
						|
};
 |